Quick Start

You will finish this page with a repository connected, a scan completed, and your first real findings triaged. Budget about ten minutes, most of it waiting for the scan.

---

1. Create your account

Go to your Argus URL and sign up. You can use email and password, or sign in with Google.

Use your work email address. Argus organizations are built around a company domain, so accounts on public providers such as gmail.com and outlook.com cannot create one. If you were invited by a colleague, open the invitation link instead. That works from any address.

Signing up creates your organization and makes you its first Admin.

---

2. Complete onboarding

A five-step wizard runs once: Welcome → About you → Integrations → First project → How Argus works.

About you asks for your organization name, your role, team size, the languages in your stack, your primary goal, and, optionally, where you deploy, which compliance frameworks matter, and how you heard about Argus. It takes under a minute, and you can change all of it later.

Integrations is where you connect GitHub. Do it now; everything else is easier afterwards.

---

3. Connect GitHub

1. On the Integrations step, or later at Settings → Integrations → Source Control: click Connect on the GitHub card.
2. GitHub asks which account or organization to install the Argus App on, and which repositories to grant.
3. Grant the repositories you want scanned and confirm.
4. GitHub sends you back to Argus. Your connected account appears as a chip on the GitHub card.

Installing on a second account later is additive, the first stays connected.

If you are not an owner of the GitHub organization, GitHub records your install as a request. Nothing connects until an owner approves it. Argus shows the pending state rather than pretending it worked.

Argus never asks for repository or organization administration permissions. It reads code and pull requests and posts a check. Making that check block merges is something you do yourself, see Pull request security.

No GitHub? Use a Git URL

Projects → Add project → Public Git Repository takes a repository URL directly. You will not get pull-request review, but scanning works.

---

4. Import a repository

1. Go to Projects.
2. Click Import from GitHub.
3. Pick a repository from the list.

Importing is free and does not consume a credit. It also does not start a scan. You choose when that happens.

Start with a real service, not a toy repo. Argus is most useful where there are actual dependencies, actual routes and actual secrets to find.

Removing a project

Projects → open a project → Settings → Remove project. You must type the project's name to confirm, and only an Admin can do it, an API key cannot.

Removal is irreversible and cascading: it deletes the project's findings, scan history, BOMs, API inventory and dependency records. There is no archive and no undo. Your Git repository is not touched, only Argus's copy of what it found. Re-importing gives you a fresh project with no history.

---

5. Run your first scan

On the project card, click Scan ›.

1. Under Vulnerability types to scan for, leave SAST, SCA and SECRET ticked.
2. Under SAST Scan Depth, choose Standard Scan.
3. Click Start Scan.

You will see Scan queued for <project>.

Standard is the right choice for a first run. Deep Agentic (10 credits) adds an autonomous AI agent that explores the repository, worth doing once you have looked at the standard results.

While it runs

Open Scan Jobs. Each row shows a live progress bar and an estimated time remaining. A typical repository takes a few minutes; a large monorepo takes longer.

Behind the scenes Argus is running source analysis, resolving your lockfiles against public advisory data, hunting for committed credentials, checking your infrastructure-as-code and container base images, working out which vulnerable dependencies your code actually imports, cataloguing your API routes and third-party calls, and generating your bill of materials. Full detail in Scanning.

If the scan fails, the credits it consumed are refunded automatically.

---

6. Read your first findings

When the job reads Completed, open Issues.

You are looking at every finding, sorted by priority rather than raw severity. That ordering is the point: Argus multiplies CVSS by whether the vulnerable code is actually reachable, and by real-world exploitability signals, EPSS probability, CISA KEV listing, exposure. A reachable, actively-exploited CVE outranks an unreachable critical every time.

A first pass that actually works

Start with what is reachable and exploitable.

1. In the left rail, under Severity, tick Critical and High.
2. Under Reachability, tick Reachable.

What remains is your genuine first-day work queue. Everything else is still there, ranked below it.

Then collapse the duplicates. Turn on Group related above the table. Findings that share one fix, every CVE on a single dependency, every occurrence of one rule, collapse into a single row. A hundred-row backlog often becomes fifteen decisions.

Then open one. Click any finding. The drawer gives you the priority score and why it scored that way, the reachability verdict with its evidence, the exact file:line, the description, numbered remediation steps, and, where an AI pass ran, the attack scenario and taint chain.

Triage the noise

Security scanners produce false positives. Argus gives you two ways to deal with them:

• Re-verify with AI. Select a batch of doubtful findings and click Re-verify with AI in the bulk bar. It re-runs triage and conservatively auto-marks confident false positives. 2 credits per batch, up to 25 findings.
• Mark them yourself. Set a finding to False Positive or Accepted Risk from the drawer, or use Suppress in the bulk bar for a whole selection.

Suppressed findings stay in your data and stay auditable. They just stop competing for attention.

Fix one

Pick a real finding and click Assign to Agent · 15 credits.

The AI Security Engineer clones the repository, applies the smallest correct fix, verifies it with a build, and opens a pull request. It takes a few minutes and you can close the modal while it works. Argus never merges anything. You review the PR like any other.

If you would rather see the diff before spending credits, use Remediation → Preview AI fix.

---

7. Read the dashboard

Open Dashboard. Set the range with the 7d / 30d / 90d control.

The Merge protection banner appears until you have required the Argus check in GitHub. That is the single highest-value thing you can do next.

---

8. Turn on the pull-request reviewer

Once the App is installed, Argus reviews every pull request automatically, inline comments on the changed lines, a summary verdict, and an Argus / security-review commit status.

To make that status block merges, apply one of the two setup options at Settings → Integrations → Merge protection. Both are copy-paste ready, and both are applied with your own GitHub credentials.

Full walkthrough: Pull request security.

---

9. Optional but high-value

---

Where things live

The navigation has three product sections plus Settings.

Posture, how exposed am I?

Discovery, what do I have?

Defense, what is being done about it?

Settings: integrations, AI, policies, rules, team, billing.

Moved in 2026-08. Four screens became tabs on the pages they belong to: Pipeline Security → Scan Jobs, Dev Risk → Git Posture, ATT&CK Heatmap and Risk Scenarios → Attack Paths. Old links still work. They redirect to the right tab.

Press ⌘J anywhere to ask the built-in assistant a question about your own data.

---

Next

• Concepts, severity vs priority, reachability, credits
• Scanning, what each engine actually looks at
• Issues and remediation, working the backlog properly